Free HIPAA BAA checker.
Drop a Business Associate Agreement and see whether it contains the terms HIPAA requires, with each finding tied to the section of 45 C.F.R. Part 164 behind it. Your document never leaves your browser.
Check your BAA now →- Free forever (MIT)
- Nothing uploaded
- No account
- 1,946 cited checks
- PDF, DOCX or text
What it checks in a BAA
45 C.F.R. § 164.504(e) required terms
Permitted uses and disclosures, safeguards, reporting, access and amendment, accounting, HHS access to books and records, and return or destruction at termination.
Security Rule flow-down
The § 164.314(a) obligations for electronic protected health information.
Breach notification
Whether the business associate must report breaches of unsecured PHI, and how fast, under § 164.410.
Subcontractor BAAs
Business-associate-to-subcontractor agreements have their own playbook, so the downstream chain is checked too.
Scope against the main agreement
Drop the BAA with its services agreement and Vaulytica flags a BAA that is broader than the agreement it sits under.
What you get
A page that says what to raise and why
Each item opens to the clause it is about, the reason, the rule's suggested change and its source.
Your draft back with comments
Drop a .docx and get it back with each item as a Word comment on its clause.
Everything else, if you want it
A Word report, dates for your calendar, and spreadsheets of obligations and fixes.
How it works
- Open vaulytica.com — no account, nothing to install.
- Drop your PDF or DOCX, or paste the text. It is read inside your browser tab; nothing is uploaded.
- Get your report in seconds. The document type is detected and only the checks that belong to it run.
Questions
Is a BAA checker the same as HIPAA compliance?
No. It checks the contract's terms. Compliance also depends on what the parties actually do, which no document review can confirm.
Can I use it on documents with patient information?
The document is processed only in your browser and nothing is uploaded. Follow your own organization's policies for handling PHI.
Does it check Notices of Privacy Practices?
Yes. HIPAA Notices of Privacy Practices have their own playbook.